Hi Sudip,
While looking at atomic_t usages and noticed a few potential
problem the way struct pp_struct: atomic_t irqc field
- There is inconsistencies the lock hold in this driver.
pp_do_mutex is help before pp_do_ioctl() is called.
static int pp_do_ioctl()
....
pp_do_mutex
case PPCLRIRQ:
ret = atomic_read(&pp->irqc);
if (copy_to_user(argp, &ret, sizeof(ret)))
return -EFAULT;
atomic_sub(ret, &pp->irqc);
return 0;
This path seems safe as far as atomic_t overflow is concerned.
However, pp_poll(), pp_irq(), and pp_open() etc. don't hold
lock while pp_do_ioctl() path does.
Something to look into to see if this is safe. I see this
comment for pp_poll() /* No kernel lock held - fine */
Anyway, please take a look and see if this is indeed a problem.
thanks,
-- Shuah
